Finance
Greek Firms Scan Computer Systems as Iran War Raises Cyberattack Risks, Sources Say
Published by Global Banking & Finance Review®
Posted on March 18, 2026
2 min readLast updated: March 18, 2026
Quick Summary
Greek companies—including shipowners and firms in transport, banking, energy, telecoms and health—are conducting pre‑emptive cyber scans following a high‑priority advisory by Greece’s National Cybersecurity Authority amid heightened Iran‑war-related cyber threats.
Greek Companies Strengthen Cyber Defenses as Iran-linked Attacks Rise
Rising Cybersecurity Concerns Among Greek Companies
By Renee Maltezou and Yannis Souliotis
ATHENS, March 18 (Reuters) - Greek shipowners and other companies are scanning their computer systems for evidence of cyberattacks after advice from the National Cybersecurity Authority, two sources said on Wednesday following incidents that have been linked to the Iran war.
The authority last week sent an advisory, seen by Reuters, to security officers of shipping companies, banks and firms in the transport, telecommunications, health and energy sectors, a source at the authority said, adding that the move was pre-emptive.
Recent Iran-linked Cyberattacks in the Region
An Iranian-linked hacking group claimed responsibility on March 11 for a cyberattack on U.S.-based medical device and services provider Stryker, according to messages posted to the group's Telegram channel.
Albania has also confirmed a cyberattack on the digital infrastructure of its parliament last week that local media said was by the Iran-linked, self-styled "Homeland Justice" group.
Greek Advisory and Response Measures
GREEK ADVISORY URGES SCANS
Details of the Advisory
The Greek advisory, marked "high-priority", urged firms to perform the scans and inform security officers of a confirmed incident that affected a "large international organisation" abroad. It did not name it.
It listed indicators of possible compromise, including IP addresses, tools and malware, such as the VShell Remote Access Trojan. Anyone finding evidence of attack should immediately review their systems and block those IPs, it said.
Shipping Companies and Navigation System Threats
Two separate sources said at least two shipping companies have received the warning. Electronic interference with commercial ship navigation systems has surged in recent days around the Strait of Hormuz and the wider Gulf.
All the sources asked not to be named because they were not authorised to speak to the media.
Investigation Findings and Attribution
The first two said Greece had yet to find evidence of a significant attack, although one of them said "some sort of activity" had been tracked.
The Greek advisory said an investigation into the confirmed incident had pointed to an unidentified, sophisticated threat actor using two layers of infrastructure to scan activity, attempt unauthorised access, host malware or run command-and-control mechanisms and avoid being traced.
The second source said that some of the IP addresses listed in the Greek advisory originated from Iran.
(Additional reporting by Fatos Bytyci in Pristina; Editing by Barbara Lewis)
Key Takeaways
- •Greece’s cybersecurity regulator urged scans after a ‘large international organisation’ abroad was hit in an incident tied to Iran‑linked hacking.
- •The advisory cited IPs, tools and malware (notably the VShell Remote Access Trojan) and recommended immediate response if detected.
- •The alert follows Iran‑linked ‘Handala’ group’s March 11 cyberattack on U.S. medical‑tech firm Stryker, and a recent cyber incident claimed by Iran‑linked hackers targeting Albania’s parliament.
Frequently Asked Questions about Greek firms scan computer systems as Iran war raises cyberattack risks, sources say
1Why are Greek companies scanning their computer systems for cyberattacks?
Greek companies are scanning for cyberattacks after advice from the National Cybersecurity Authority due to increased risks linked to the Iran war.
2Which sectors in Greece received the cybersecurity advisory?
Shipping companies, banks, and firms in the transport, telecommunications, health, and energy sectors received the advisory.
3What indicators of compromise were listed in the Greek advisory?
The advisory listed specified IP addresses, tools, and malware such as the VShell Remote Access Trojan.
4Has Greece found evidence of major cyberattacks so far?
No significant attack evidence has been found, though some suspicious activity has been tracked.
5What should companies do if they find evidence of a cyberattack?
They should review their systems and immediately block the suspicious IP addresses as advised.
